cleveragents/cleveragents-core
4
0
Fork 3
Code Issues 6.0k Pull Requests 115 Actions Packages Projects Releases Wiki Activity

docs(spec): clarify security mode must be cached at initialization time #7385

Closed
HAL9000 wants to merge 1 commits from spec/arch-security-mode-init into master
pull from: spec/arch-security-mode-init
merge into: cleveragents:master
Conversation 8 Commits 1 Files Changed 1
+13

1 Commits

Author SHA1 Message Date
HAL9000 0dc96ab6b1 docs(spec): clarify security mode must be cached at initialization time
CI / benchmark-publish (pull_request) Has been skipped
Details
CI / build (pull_request) Successful in 38s
Details
CI / lint (pull_request) Successful in 39s
Details
CI / quality (pull_request) Successful in 38s
Details
CI / helm (pull_request) Successful in 35s
Details
CI / push-validation (pull_request) Successful in 38s
Details
CI / typecheck (pull_request) Successful in 56s
Details
CI / security (pull_request) Successful in 1m2s
Details
CI / e2e_tests (pull_request) Successful in 3m22s
Details
CI / unit_tests (pull_request) Successful in 6m33s
Details
CI / integration_tests (pull_request) Successful in 6m38s
Details
CI / docker (pull_request) Successful in 32s
Details
CI / coverage (pull_request) Successful in 11m32s
Details
CI / status-check (pull_request) Successful in 1s
Details
CI / benchmark-regression (pull_request) Successful in 59m27s
Details 
Bug #7373 found that PermissionService.is_local_mode() reads the
CLEVERAGENTS_SERVER_MODE environment variable on every permission check
call. This creates a TOCTOU vulnerability: if any code path can modify
os.environ during a session, the security mode can be changed mid-session,
bypassing permission enforcement.

Added a 'Security mode initialization contract' to the Security section
clarifying that:
- Deployment mode (local vs. server) MUST be determined once at service
  initialization time and cached
- Never re-read from environment variables on each permission check
- PermissionService and any other mode-gating service must cache at init

Refs: bug #7373 (PermissionService.is_local_mode() TOCTOU vulnerability)
 2026-04-10 18:45:50 +00:00